Logcheck - can't ignore liblogging-stdlog anymore

Kernels & Hardware, configuring network, installing services

Logcheck - can't ignore liblogging-stdlog anymore

Postby pycha » 2017-07-17 20:16

Hi everyone;
After migrating to stretch, I can't get rid of certain message via logcheck. This one:
Code: Select all
Jul 17 06:25:03 host liblogging-stdlog:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="326" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
It appears in messages and syslog. I used to have my ignore rules in logcheck working, as it was rsyslog, but now I can't. The following regex is in ignore.d.server/rsyslog and ignore.d.server/liblogging-stdlog and ignore.d.server/syslog (probably too much).
Code: Select all
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ liblogging-stdlog:  \[origin software="rsyslogd" swVersion="[0-9.]+" x-pid="[[:digit:]]+"x-info="http:\/\/www\.rsyslog\.com"\] rsyslogd was HUPed$

Both configs successfully tested using logcheck test. For instance:
Code: Select all
# logcheck-test -l /var/log/messages liblogging-stdlog
Jul 17 06:25:04 host liblogging-stdlog:  [origin software="rsyslogd" swVersion="8.24.0" x-pid="326" x-info="http://www.rsyslog.com"] rsyslogd was HUPed
================================================================================
parsed file: /var/log/messages
used rule: 'liblogging-stdlog'


But... These lines are still being mailed to me as a warning. Am I using a wrong ignore file, or... ? :BUMP:
Any ideas / help appreciated!
pycha
 
Posts: 1
Joined: 2017-07-17 20:03

Return to System configuration

Who is online

Users browsing this forum: No registered users and 10 guests

fashionable